What’s New in E3 Platform Bronze Edition 2.0

General Changes:

Electronic Evidence Examiner now has a 64-bit version with most plug-ins available allowing it to take full advantage of optimizations associated with 64-bit operating system.

New Scripting capabilities! You can now develop your own scripts with the automation scripts options for evidence data processing using our Python SDK. E3 Python SDK is available under the same license as E3.

Case files have an option to be manually named. Now, you will be able to define a case name and location manually before device acquisition, data importing and evidence adding.

Ability to detect even more encrypted file types when using the content analysis wizard sorting option.

The installation wizard has been improved to be faster and clearer.

Minor GUI improvements for better user-experience.

Overall stability has been improved.

New Add-on Licenses:

NEW-Image Analyzer functionality has been incorporated. This is a new Add-On option for the E3 Platform that can be purchased for any one of the licensing options. This new scanner will allow data to be sorted and categorized into categories as Drugs, Gore, Porn, Swim/Underwear, Terrorism, and Weapons. To use this feature, you will need to activate the E3 Image Analysis Boost package and pay the additional license fee.

Hard Drive Forensics Features:

Detection of new Windows 10 artifacts has been added to Data Triage. You are now able to find:

- Folders with recorded Cortana voice commands in audio files. - Folders with installed Windows applications and packages, as well as deleted Windows applications. - Information on Windows File History, as well as file backups and their location.

Mobile Data Acquisition/Parsing Changes:

User Activity Timeline feature for logical acquisition of Android devices has been added. Now you can view what actions were performed on the device at the certain moment of time.

Android logical plug-in has been improved:

- Now, logical acquisition is performed much faster as unnecessary attempts of device rooting can be skipped. - File System and Android Backup can be acquired separately during the Custom acquisition. - The File System feature contains data stored in the Media Card and External Memory feature (this data can be received without gaining root access). - Potential issue with correct parsing of folder names in the Android backup feature has been fixed.

Android Physical plug-in has been improved:

- Ability to select the features for acquisition has been added for manual plug-in selection. - The Full Flash (SD Card included) feature has been replaced with two new features: Flash Partitions and File System. Now, more data is acquired and parsed during physical acquisition (including the encrypted data partition). - More data is parsed and displayed in the user-friendly-format, such as Installed Applications, Authentication Data, Recovered Contacts, Recovered Call History, Recovered Calendar, Recovered SMS History, and Recovered MMS History. - The com.paraben.service (SeizureService) service is no longer installed on the device.

More MTK chipsets are now supported. Thus, we are now able to perform physical acquisition of even more MediaTek devices.

iOS 12 devices are now supported for logical acquisition in E3.

Android Pie is now supported for logical acquisition in E3.

Logical acquisition of iOS devices became faster.

Ability to view the images of contacts in the grid for iOS devices has been added.

Potential issue with viewing the correct size of MMS attachment images on Android devices has been resolved.

Export/Reports Changes:

Thumbnails of MMS attachments on iOS devices are now added to the Mobile Data Review Report.

Potential issue with exporting large mailstorages to PST format has been fixed.

Potential issue with opening the Mobile Data Review Report in Edge browser has been fixed.

Potential issue with navigation in the Mobile Evidence Timeline Report when viewing it in the Internet Explorer and Edge browsers has been fixed.

Potential issues with adding thumbnails of images to the report and text representation for search have been fixed for the Mobile Evidence PDF Report.

Potential issues with the correct parsing of the embedded data and displaying the links have been fixed for the HTML Investigative Report.